Dutch Municipalities Continue to Leak Citizen Personal Data, Including National ID Numbers
An investigation by NOS and Nieuwsuur has revealed that Dutch municipalities are still inadvertently publishing personal data of citizens online, despite the issue being known for years. The Dutch Data Protection Authority (AP) had urged municipalities to handle citizen data publication with care back in 2017. Nevertheless, hundreds of documents containing email addresses, private phone numbers, and addresses were found. Some documents also included identity card numbers and even national identification numbers (BSN). This often occurs when citizens apply for permits or comment on local plans, such as the establishment of an asylum seekers' center. While municipalities must publish such information online due to the Open Government Act, personal details should be redacted, a process that is frequently incomplete or inadequate.
The NOS investigation identified BSN numbers in 255 documents, with one municipality, Pijnacker-Nootdorp, containing 43 such numbers along with names, addresses, and contact details of citizens who had provided feedback on a construction project. In a separate incident, the municipality of Midden-Delfland mistakenly published the names and addresses of 133 residents who opposed an asylum seekers' center, leading to resident concerns. The municipality has since replaced the document and notified affected individuals.
While municipalities are taking the findings seriously and are in the process of removing or anonymizing the affected documents, the VNG (Association of Netherlands Municipalities) notes that anonymizing millions of documents is a significant task for which municipalities do not receive separate funding. The AP has reported an increase in data leak notifications from municipalities, with over 120 received this year compared to 75 last year, suggesting the problem may be more widespread. Although many municipalities have implemented automated redaction software since 2018, a human review is still often required, and some systems lack automatic checks for sensitive data.
The recurring publication of sensitive personal data by Dutch municipalities highlights a systemic challenge in balancing transparency mandates with robust data protection protocols. Despite prior warnings and the implementation of new regulations and software, human error and procedural gaps persist. The financial and resource constraints cited by the VNG in anonymizing historical documents suggest that current data governance frameworks may not adequately account for the ongoing labor required to rectify past oversights. Looking ahead, the increasing reliance on AI for data processing in government systems, as noted by software providers, presents both an opportunity for improved redaction and a potential new vector for vulnerabilities if not rigorously audited. The situation underscores the need for continuous evaluation of data handling processes, enhanced training, and potentially dedicated funding to ensure compliance with privacy laws and safeguard citizen trust in the digital age.
AI-generated to prompt reflection — not editorial opinion, not advice, not a statement of fact. How this works.